Slashdot Mirror
Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M (krebsonsecurity.com)
Brian Krebs reports: Hackers used phishing emails to break into a Virginia bank in two separate cyber intrusions over an eight-month period, making off with more than $2.4 million total. Now the financial institution is suing its insurance provider for refusing to fully cover the losses. According to a lawsuit filed last month in the Western District of Virginia, the first heist took place in late May 2016, after an employee at The National Bank of Blacksburg fell victim to a targeted phishing email. The email allowed the intruders to install malware on the victim's PC and to compromise a second computer at the bank that had access to the STAR Network, a system run by financial industry giant First Data that the bank uses to handle debit card transactions for customers. That second computer had the ability to manage National Bank customer accounts and their use of ATMs and bank cards.
Why bother with security or training when it is just cheaper to let the insurance or lawyers pay?
Get 2FA physical tokens people.
...the clerk never got that $100 Applebee's gift card.
Care killed the cat, but satisfaction brought it back.
Maybe people should just stop using E-mail. It's more trouble than it's worth.
It's no longer about preventing attacks from happening, but accepting that they are going to happen and hardening systems to minimize or eliminate theft and damage when they do. This might seem obvious to a lot of people in the tech industry, but it represents a major paradigm shift for banking.
If you didn't secure your shit after the first hack.
Why would anyone cover you for the second one 8 months later?
Yall stupid. no insurance for you, fuck off.
Now the financial institution is suing its insurance provider for refusing to fully cover the losses.
Hack me once, shame on you, hack me twice, shame on me?
Seriously, 8 months passed between the phishing incidents. That's plenty enough time to do a security audit and train your staff, and the insurance company knows that.
If you post as Anonymous Coward, don't expect a reply.
Going out of business takes away things to lose and destroy, so it's pretty effective at conveying the importance of doing things right the first time to the survivors.
Every computer in your organization has USB enabled? Interesting, interesting indeed. Reminds me of times when one could just distribute free music disks near the bull and the whole Wall Street would listen...
Sony, Home Depot, and a number of others have been compromised because they failed to separate what should be secure systems from the rest of their infrastructure. This behaviour is blatantly negligent.
Let's get something straight. Phishing emails are not hacking. And the stupids who fall for them are the ones responsible for all of this. People can't be trusted with their own security and do not have the skills to discern phishing attempts from customer service emails. We're fucked.
Things always go in threes.
Slashdot, fix the reply notifications... You won't get away with it...
What exactly is wrong with kerbs? I mean besides you obviously don't like them. Considering it was that blog that broke the story...
Here is another article but point to kerbs as the source.. aren't we always complaining that the editors don't go to the source?
https://www.finextra.com/newsarticle/32435/bank-hacked-twice-in-a-year-sues-insurer
It doesn't look like the major news sites have picked up this story yet, so I am not sure what you want here... With the pdfs for the lawsuit being linked on kerbs, it certainly doesn't look like he made it up.... So why the hate on kerbs there sluggo?
I can tell you working in the bank IT industry that we are watching this situation.
Google has not been phished. That is not the same as not attacked or owned in some other way.
But yeah, they clearly fucked up.
With ubiquitous smartphones. I'm back to don't connect your work network to the internet, at all, for 90-99%% of staff. The rest get in through dedicated machines on a dedicated network, which are scanned for changes (which are logged) then reimaged, nightly.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
You may have had experience related to insurance and the fire code. Someone may have walked through your office building doing a fire inspection, looking for things like power strips plugged into other power strips, which are in turn plugged into another power strip. That fire inspection was likely done for insurance reasons. The insurance companies created the National Fire Protection Association, which writes the fire codes, and also created Underwriters Laboratories (UL), which does fire testing and allows it's logo to be put on tested products. You've certainly seen products that are UL listed, UL registered, and UL certified. These are some of the ways that insurance companies encourage fire safety.
If you don't comply with fire code, if you're using electrical appliances that aren't UL listed or better, the insurance company will start taking actions that encourage safety compliance. That can range from simply issuing a recommendation to raising your rates until you comply, and even saying "if this problem isn't fixed within three months, we will no longer cover you for electrical fires". The insurance company analyzes the risks and sets rates and other conditions appropriate for the level of risk.
My company, which does cybersecurity, is working with insurance companies to rate cyber risk the same way the rate fire risk. A company's rates will depend on what safeguards they have in place. Take Windows updates for example. If you roll out all Windows updates within 24 hours of release, you'll get the best rate. Roll them out within 2 weeks and you'll get a middle rate. Have XP servers exposed to the internet? The insurance company will probably give you 60 days to fix that, or you're no longer covered for certain things. It's not an all or nothing thing. We deliver a big report, it can be over 100 pages. Each thing in the report can increase or decrease the rate they pay for insurance, or cause the insurance company to not cover certain things until they get fixed.
Here they had a huge loss due to phishing. When paying out that first phishing claim, the insurance company probably said "we don't want this to happen again. In order to be covered for future phishing, you need to reduce your risk by doing x, y, and z". Sure enough 8 months later, another huge loss due to phishing. The bank probably didn't put proper measures in place to mitigate the risk.
One way to reduce phishing risk is for corporate security to send out a "phishing" email about once per month. Employees who click the link see a page reminding them about phishing. Employees who click the "report this email" button in Outlook get a smiley acknowledgement that they did the right thing.
You know, Slashdotters, some time ago I started thinking that people were getting dumber as a whole over time instead of smarter, and I said so.
Then some time passed, and I came to another, worse realization: People have always been dumb, it's just that I'm starting to really notice it more now.
Memo to all businesses: YOU HAVE TO DO BETTER WITH THIS SHIT ONE WAY OR ANOTHER!
The current state of computer system security, all over the world so far as I can tell, is dismal. So far as I can tell from what I read and hear: criminal organizations, cyber-enabled terrorist organizations, cyber-operatives for foreign governments/foreign military, already have the ways and means to hack their way into any systems they choose, including critical infrastructure, government, and military systems; they're all just waiting for orders to attack. All the successful attacks you hear about every week? Those are just practice runs and small-time operations for pocket money and proofs-of-concept. Furthermore, as-is, anyone with a smartphone or 'IoT' devices, Internet-facing NAT routers, etc, are just as likely as not to already be part of someones' bot-net, even if the code is sitting dormant on it for now, waiting for commands from their C&C servers.
So the question is:How do we fix all this? Failure is NOT AN OPTION.
Sony proved that it's more cost effective to be hacked a few times than hire numerous competent people to make strong systems [ didn't say they did it on purpose though, do not attribute to malice that which is equally explained by incompetence ].
Slashdot, fix the reply notifications... You won't get away with it...
You're being sarcastic, but sure, let's see how 'cost effective' flies with everyone when power plants blow themselves up, there' no water coming out of the tap, and everyones' bank accounts are drained, all at the same time.
FOLLOW-UP: https://politics.slashdot.org/... Should we start a betting pool? How about a doomsday clock? Shit needs to be fixed NOW.
Dude, seriously?
At the corporate level, failure is always an option ... even if the idiots in management are incapable of seeing it.
And when it comes to security of devices, failure in terms of security is almost always a given, because companies want to push out incomplete products as soon as they can. And I assure you, the security isn't the first thing they do.
The reason you hear about this every week is precisely because failure is not just an option, it's apparently a preferred outcome as long as the vendor gets paid for their shitty product with terrible security.
Part of the problem, if judging by the existing 41 comments here on Slashdot, is IT people either *can't* or *won't* read. All y'all are bitching about an insurance company denying the claim, etc.
They didn't deny the claim! There are *two* policy riders possibly that cover situation and the insurance company is claiming the one with the $250,000 cap is the one that applies -- so paid that one.
It is an interesting *legal* situation, but totally not at all what the slashmob is whining about.
Learning HOW to think is more important than learning WHAT to think.
FTFA: "the 2017 breach was embedded in a booby-trapped Microsoft Word document."
Unfortunately most people are too dumb to dump MS, and crackers will continue to win.
That is DEFACTO affirmation that they accepted the risk.
The best case for the insurance company is that claims aren't filed, and they don't have to do investigations or pay lawyers, they just collect premiums and use about 10% of that on compilance measures. It's not only cheaper for them to not have to deal with claims, but fewer $100 million claims means their risk is lower, their quarterly numbers are more predictable. That's good for them overall, and reduces their rate for re-insurance (the insurance that is purchased by insurance companies).
Let's see how they feel about 'failure being an option' when they're dragged by their feet out into the street and introduced to Monsieur Guillotine.
See subject & your BLUNDER you could IMITATE my program in 1 afternoon (+ stealing unique methods I use in it) https://linux.slashdot.org/com...
* Unbelievable...
(How LONG has it been now you've been either STALKING me by UNIDENTIFIABLE anonymous posts OR IMPERSONATING me ala https://politics.slashdot.org/... ?)
APK
P.S.=> Grow up & get OVER your "butthurt" (I must've severely embarassed you @ some point - I rarely IF EVER 'start it' but I do finish it - letting "your kind" FINISH THEMSELVES off as you did in the link example above - your kind (probably ONLY YOU imo) do it to yourselves)... apk
Fuck banks and their brain dead people !
They should buy brain-dead computers from Apple, rumor has it it was also designed for brain-dead work LOADS !
GIVE UP BANKS.
You not suited for tomorrows hi-tech IT reality.
In the mid-1980's the place I worked at was burglarized. They took things like typewriters. (Uh, 1980's...).
A few weeks later that came back stole the New typewriters.
When the second theft was reported to the police, a policeman told someone at the company. "Oh yeah. They do that." Come back for seconds.
Around 2013 one of my friend's home was burglarized. Computers, flat screen tv, etc. A few weeks later they came back for seconds, stealing the new stuff. A policeman told them. "Oh yeah. They do that." Come back for seconds.
Same police department.
Too bad banks are too cheap to invest in computer security and training. But let's sue the insurance company to get our money back! Haha. That's funny.
With Zero-Day discoveries being found all the time, any evil computer science genius can screw the systems six ways to Sunday.
What's needed is hard backups and system analysis software to alert the CT people that something strange is happening. We've given the whole world the keys to the treasure chest.
You know, I give you a lot of shit. But I take it back, you're ok.